ITL: add check_http args for SSL version forcing

The -S argument of check_http can take a number, which forces the connection to
use a specific SSL version.  This is implemented as multiple options because
check_http does not accept the number following -S if they are separated.

fixes #10358

Signed-off-by: Michael Friedrich <michael.friedrich@netways.de>

diff --git a/doc/7-icinga-template-library.md b/doc/7-icinga-template-library.md
index 0f7083b5ed2f205d75a5bf0d2f3c6ca960a5052f..fad70a5ac9efc38c9cb35e2d0fb755c7eb5832fd 100644 (file)
--- a/doc/7-icinga-template-library.md
+++ b/doc/7-icinga-template-library.md
@@ -436,6 +436,9 @@ http_vhost               | **Optional.** The virtual host that should be sent in
 http_uri                 | **Optional.** The request URI.
 http_port                | **Optional.** The TCP port. Defaults to 80 when not using SSL, 443 otherwise.
 http_ssl                 | **Optional.** Whether to use SSL. Defaults to false.
+http_ssl_force_tlsv1     | **Optional.** Whether to force TLSv1.
+http_ssl_force_sslv2     | **Optional.** Whether to force SSLv2.
+http_ssl_force_sslv3     | **Optional.** Whether to force SSLv3.
 http_sni                 | **Optional.** Whether to use SNI. Defaults to false.
 http_auth_pair           | **Optional.** Add 'username:password' authorization pair.
 http_proxy_auth_pair     | **Optional.** Add 'username:password' authorization pair for proxy.

diff --git a/itl/command-plugins.conf b/itl/command-plugins.conf
index a6257f9e42bb1edd47aeefc731b33fb231700091..e017952db6fed0cdee735438e653283fa48a6747 100644 (file)
--- a/itl/command-plugins.conf
+++ b/itl/command-plugins.conf
@@ -331,6 +331,15 @@ object CheckCommand "http" {
                "-S" = {
                        set_if = "$http_ssl$"
                }
+               "-S1" = {
+                       set_if = "$http_ssl_force_tlsv1$"
+               }
+               "-S2" = {
+                       set_if = "$http_ssl_force_sslv2$"
+               }
+               "-S3" = {
+                       set_if = "$http_ssl_force_sslv3$"
+               }
                "--sni" = {
                        set_if = "$http_sni$"
                }